Deployment Example: SAML v2 Using Sun OpenSSO Enterprise 8.0

Chapter 7 Installing Sun Java System Directory Server and Creating Instances for User Data

This chapter contains instructions for installing Sun Java™ System Directory Server and creating the instances in which Sun OpenSSO Enterprise user data will be stored. Additionally, the procedure for enabling multi-master replication between the two instances and the procedure for configuring the user data load balancer are included. This chapter contains the following sections:

Note –

If you have an existing user data store, you can go directly to the instructions in Chapter 8, Deploying and Configuring OpenSSO Enterprise.

7.1 Installing and Configuring Directory Server 1 and Directory Server 2

This section contains the instructions for installing Directory Server on two different host machines and creating the directory instances named sp-users in which the user data will be stored. Use the following list of procedures as a checklist for completing the task.

To Download the Directory Server Bits and Required Patches to the Directory Server Host Machines

Use this procedure to download the Directory Server Enterprise Edition (EE) 6.3 bits and the required system patches to both the Directory Server 1 host machine (ds1.sp-example.com) and the Directory Server 2 host machine (ds2.sp-example.com).

Access http://www.sun.com/software/products/directory_srvr_ee/get.jsp from a web browser and click Download Now.

Provide the following information in the Select product configuration section and click View Downloads.

Step 1: Select Component

Directory Server Enterprise Edition 6.x

Step 2: Select Version

6.3

Step 3: Select Delivery Type

Compress Archive (ZIP)

Step 4: Select Platform

Choose the platform you are using.

The Selection Results page will be displayed with links to the download sites for the Directory Server bits and required patches.

Note –
The patch numbers generated for download on the Selection Results page are based on your input. Check the most recent Directory Server Enterprise Edition 6.1 Release Notes to determine if you need to install other patches based on your machine's architecture and operating system. In this deployment, the Release Notes indicate that based on the hardware and operating system being used, patch 118855, patch 127112, patch 119964, patch 125379, and patch 119255 are required.

Log into the ds1.sp-example.com host machine as a root user.

Run patchadd to see if the patches are already installed.

See the patchadd man page for more information.
# /usr/sbin/patchadd -p | grep 118855
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 127112
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 119964
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 125379
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 119255
No results are returned which indicates that the patch is not yet installed on the system.

Note –
If the necessary patches are already installed on your machine, proceed to step 7.

Make a directory for the patch downloads and change into it.
# mkdir /export/patches # cd /export/patches

Download the patches.

You can click on the patch links from the Selection Results page or search for patches directly at http://sunsolve.sun.com. If searching directly, navigate to the PatchFinder page and enter the patch number. For each patch you are downloading, click the HTTP link beside the heading Download Signed Patch (xxx bytes).

Note –
Signed patches are downloaded as JAR files. Unsigned patches are downloaded as ZIP files. In this step, ZIP files are downloaded.

Make a directory for the Directory Server download and change into it.
# mkdir /export/DS63 # cd /export/DS63

Download the Base Full Install of Directory Server EE 6.3 — Zip Distribution, Multi-Language, (DS/DPS/DE/ISW/DSRK) bits.

Note –
No Directory Server Administration Console is installed with these bits. This deployment example uses the command line to configure the software.

Log out of the ds1.sp-example.com host machine.

Repeat this same procedure on the ds2.sp-example.com host machine.

To Patch the Directory Server Host Machines

If necessary, use this procedure to patch both the ds1.sp-example.com host machine and the ds2.sp-example.com host machine.

Change into the directory that contains the downloaded patch files.
# cd /export/patches

Unzip the patch files.

# unzip 118855.zip
# unzip 127112.zip
# unzip 119964.zip
# unzip 125379.zip
# unzip 119255.zip

Install the patches.

# /usr/sbin/patchadd /export/patches/118855
# /usr/sbin/patchadd /export/patches/127112
# /usr/sbin/patchadd /export/patches/119964
# /usr/sbin/patchadd /export/patches/125379
# /usr/sbin/patchadd /export/patches/119255

Tip –

You can use the -M option to install all patches at once. See the patchadd man page for more information.

Reboot your machine, if requested.

After installation is complete, verify that each patch was added successfully.
# /usr/sbin/patchadd -p | grep 118855
A series of patch numbers are displayed, and the patch 118855 is present.
# /usr/sbin/patchadd -p | grep 127112
A series of patch numbers are displayed, and the patch 127112 is present.
# /usr/sbin/patchadd -p | grep 119964
A series of patch numbers are displayed, and the patch 119964 is present.
# /usr/sbin/patchadd -p | grep 125379
A series of patch numbers are displayed, and the patch 125379 is present.
# /usr/sbin/patchadd -p | grep 119255
A series of patch numbers are displayed, and the patch 119255 is present.

Log out of the ds1.sp-example.com host machine.

Repeat this same procedure on the ds2.sp-example.com host machine.

To Install Directory Server 1

Before You Begin

This procedures assumes To Download the Directory Server Bits and Required Patches to the Directory Server Host Machines and To Patch the Directory Server Host Machines have been completed.

(Optional) Resolve the following issues, if necessary.
- The LD_LIBRARY_PATH environment variable should not be set to the default setting. Change the value to empty as in the following example:
  # setenv LD_LIBRARY_PATH
- The JAVA_HOME environment variable should be set appropriately for your system architecture as in the following example:
  # setenv JAVA_HOME /usr/jdk/jdk1.5.0_09

Unzip the Directory Server ZIP file.

# cd /export/DS63
# ls

DSEE.6.3.Solaris10-X86_AMD64-full.tar.gz

# gunzip DSEE.6.3.Solaris10-X86_AMD64-full.tar.gz

Untar the resulting .tar file.
# tar xvf DSEE.6.1.Solaris10-X86_AMD64-full.tar
The DSEE_ZIP_Distribution directory is the result of the decompression.

Change into DSEE_ZIP_Distribution and run dsee_deploy install to install Directory Server.
# cd DSEE_ZIP_Distribution # ./dsee_deploy install -i /var/opt/mps/serverroot
The Licensing Agreement is displayed. At each Type return to continue prompt, press Return to continue.

When Do you accept the license terms? is displayed, enter yes to continue.

Once you accept the license terms, the Directory Server binaries will be installed in the /var/opt/mps/serverroot/ds6 directory.

To Create a User Data Instance on Directory Server 1

Use this procedure to create a Directory Server instance named sp-users for storing user data. The instance uses port 1489 for LDAP and port 1736 for LDAPS.

Before You Begin

This procedure assumes you have just completed To Install Directory Server 1 and are still logged into the ds1.sp-example.com host machine as a root user.

Change to the Directory Server bin directory.
# cd /var/opt/mps/serverroot/ds6/bin

Run dsadm create to create a user data instance called sp-users.

# ./dsadm create -p 1489 -P 1736 /var/opt/mps/sp-users

Choose the Directory Manager password: dsmanager

Confirm the Directory Manager password: dsmanager

use 'dsadm start /var/opt/mps/am-users' to start the instance

Run dsadm start to start the instance.

# ./dsadm start /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' started: pid=11347

Run netstat to verify that the new instance is up and running.

# netstat -an | grep 1489

.1489		*.*		0		0  49152		0 LISTEN
.1489		*.*		0		0  49152		0 LISTEN

# netstat -an | grep 1736

.1736		*.*		0		0  49152		0 LISTEN
.1736		*.*		0		0  49152		0 LISTEN

Run ldapsearch to verify that you can read the root Directory Server entry of the new instance.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds1.sp-example.com 
-p 1489 -b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass: top
...
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.3
...

To Create a Base Suffix for the User Data Instance on Directory Server 1

Use this procedure to create the base suffix in which the user entries will be stored.

Before You Begin

This procedure assumes you have just completed To Create a User Data Instance on Directory Server 1 and are still logged into the ds1.sp-example.com host machine as a root user.

Run dsconf create-suffix to create a base suffix.

# ./dsconf create-suffix -p 1489 -B dbExample 
-L /var/opt/mps/sp-users/db/exampleDS o=spusers.com

Provide the appropriate information when prompted.

Certificate "CN=ds1, CN=1736, CN=directory Server, O=Sun Microsystems" 
presented by the server is not trusted.

Type "Y" to accept, "y" to accept just once, "n" to refuse, "d" for more details: Y

Enter "cn=Directory Manager" password: dsmanager

Tip –

When you type an uppercase Y, you are not asked for the certificate again in the next steps.

Run dsconf list-suffixes to verify that the base suffix was successfully created.
# ./dsconf list-suffixes -p 1489 Enter "cn=Directory Manager" password: dsmanager o=spusers.com
If the base suffix was successfully created, o=spusers.com is returned. You can also see sp-users in a command line list of directory instances.
# cd /var/opt/mps # ls sp-users serverroot

Log out of the ds1.sp-example.com host machine.

To Install Directory Server 2

Before You Begin

This procedures assumes To Download the Directory Server Bits and Required Patches to the Directory Server Host Machines and To Patch the Directory Server Host Machines have been completed.

(Optional) Resolve the following issues, if necessary.
- The LD_LIBRARY_PATH environment variable should not be set to the default setting. Change the value to empty as in the following example:
  # setenv LD_LIBRARY_PATH
- The JAVA_HOME environment variable should be set appropriately for your system architecture as in the following example:
  # setenv JAVA_HOME /usr/jdk/jdk1.5.0_09

Unzip the Directory Server ZIP file.

# cd /export/DS63
# ls

DSEE.6.3.Solaris-Sparc-full.tar.gz

# gunzip DSEE.6.3.Solaris-Sparc-full.tar.gz

Untar the resulting .tar file.
# tar xvf DSEE.6.3.Solaris-Sparc-full.tar
The DSEE_ZIP_Distribution directory is the result of the decompression.

Change into DSEE_ZIP_Distribution and run dsee_deploy install to install Directory Server.
# cd DSEE_ZIP_Distribution # ./dsee_deploy install -i /var/opt/mps/serverroot
The Licensing Agreement is displayed. At each Type return to continue prompt, press Return to continue.

When Do you accept the license terms? is displayed, enter yes to continue.

Once you accept the license terms, the Directory Server binaries will be installed in the /var/opt/mps/serverroot/ds6 directory.

To Create a User Data Instance on Directory Server 2

Use this procedure to create a Directory Server instance named am-users for storing user data. The instance uses port 1489 for LDAP and port 1736 for LDAPS.

Before You Begin

This procedure assumes you have just completed To Install Directory Server 2 and are still logged into the ds2.sp-example.com host machine as a root user.

Change to the Directory Server bin directory.
# cd /var/opt/mps/serverroot/ds6/bin

Run dsadm create to create a user data instance called am-users.

# ./dsadm create -p 1489 -P 1736 /var/opt/mps/sp-users

Choose the Directory Manager password: dsmanager

Confirm the Directory Manager password: dsmanager

use 'dsadm start /var/opt/mps/am-users' to start the instance

Run dsadm start to start the instance.

# ./dsadm start /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' started: pid=7191

Run netstat to verify that the new instance is up and running.

# netstat -an | grep 1489

.1489		*.*		0		0  49152		0 LISTEN
.1489		*.*		0		0  49152		0 LISTEN

Run ldapsearch to verify that you can read the root Directory Server entry of the new instance.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.sp-example.com 
-p 1489 -b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass: top
...
supportedLDAPVersion: 3
vendorName: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.3
...

To Create a Base Suffix for the User Data Instance on Directory Server 2

Use this procedure to create the base suffix in which the user entries will be stored.

Before You Begin

This procedure assumes you have just completed To Create a User Data Instance on Directory Server 2 and are still logged into the ds2.sp-example.com host machine as a root user.

Run dsconf create-suffix to create a base suffix.

# ./dsconf create-suffix -p 1489 -B dbExample 
-L /var/opt/mps/am-users/db/exampleDS o=spusers.com

Provide the appropriate information when prompted.

Certificate "CN=ds2, CN=1736, CN=directory Server, O=Sun Microsystems" 
presented by the server is not trusted.

Type "Y" to accept, "y" to accept just once, "n" to refuse, "d" for more details: Y

Enter "cn=Directory Manager" password: dsmanager

Tip –

When you type an uppercase Y, you are not asked for the certificate again in the next steps.

Run dsconf list-suffixes to verify that the base suffix was successfully created.
# ./dsconf list-suffixes -p 1489 Enter "cn=Directory Manager" password: dsmanager o=siroeusers.com
If the base suffix was successfully created, o=spusers.com is returned. You can also see sp-users in a command line list of directory instances.
# cd /var/opt/mps # ls sp-users serverroot

Log out of the ds2.sp-example.com host machine.

7.2 Enabling Multi-Master Replication of the User Data Instances

This section contains the instructions to enable multi-master replication (MMR) between two Directory Server instances, each configured as a master. This includes creating replication agreements between the masters and initializing the second directory master with the data and schema from the first directory master. The previously created sp-users user data instances will serve as the two master instances. Use the following list of procedures as a checklist for completing the task.

To Enable Multi-Master Replication for User Data Instance on Directory Server 1

(Optional) Run dsconf list-suffixes to verify that the user data instance is not already enabled for replication.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
o=spusers.com 	1		not-replicated		N/A		N/A		29	0

The "list-suffixes" operation succeeded on "ds1.sp-example.com:1489"

The base suffix of the user data instance is not replicated.

Run dsconf enable-repl to enable replication of the user data instance.

# ./dsconf enable-repl -h ds1.sp-example.com -p 1489 
-d 11 master o=spusers.com

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf create-repl-agmt" to create replication agreements on
"o=spusers.com".

The -d option takes as input a randomly chosen identifier to represent the Directory Server 1 user data instance; in this case, 11 master indicates that the user data instance is a master and not a replica. The base suffix is specified as o=spusers.com.

Run dsconf list-suffixes again to verify that the instance is now enabled for replication.

# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
o=siroeusers.com 	1		master(11)		N/A		N/A		29	0

The "list-suffixes" operation succeeded on "ds1.sp-example.com:1489"

The base suffix of the instance is master(11) indicating that the master was successfully enabled.

Log out of the ds1.sp-example.com host machine.

To Enable Multi-Master Replication for User Data Instance on Directory Server 2

(Optional) Run dsconf list-suffixes to verify that the user data instance is not already enabled for replication.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
o=spusers.com 	1		not-replicated		N/A		N/A		29	0

The "list-suffixes" operation succeeded on "ds2.sp-example.com:1489"

The base suffix of the user data instance is not replicated.

Run dsconf enable-repl to enable replication of the user data instance.

# ./dsconf enable-repl -h ds2.sp-example.com -p 1489 
-d 22 master o=spusers.com

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf create-repl-agmt" to create replication agreements on
"o=spusers.com".

The -d option takes as input a randomly chosen identifier to represent the Directory Server 2 user data instance; in this case, 22 master indicates that the user data instance is a master and not a replica. The base suffix is specified as o=spusers.com.

Run dsconf list-suffixes again to verify that the instance is now enabled for replication.

# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
o=spusers.com 	1		master(22)		N/A		N/A		29		0

The "list-suffixes" operation succeeded on "ds2.sp-example.com:1489"

The base suffix of the instance is master(22) indicating that the master was successfully enabled.

Log out of the ds2.sp-example.com host machine.

To Change the Default Replication Manager Password for Each User Data Instance

The replication manager is the user that data suppliers use to bind to the data consumer when sending replication updates. (In MMR the data consumer refers to whichever master happens to be the consumer for a particular operation.) It is recommended to change the default password created during the process of enabling replication.

Create a temporary file that contains the new replication manager password.

This file will be read once, and the password stored for future use.
# cd /var/opt/mps/serverroot/ds6/bin # echo replmanager > pwd.txt

Verify that the file was successfully created.
# cat pwd.txt replmanager

Run dsconf set-server-prop to set the replication manager password using pwd.txt as input.

# ./dsconf set-server-prop -h ds1.sp-example.com -p 1489 
def-repl-manager-pwd-file:pwd.txt

Enter "cn=Directory Manager" password: dsmanager

Remove the pwd.txt file.

Log out of the ds1.sp-example.com host machine.

Create a temporary file that contains the new replication manager password.

This file will be read once, and the password stored for future use.
# cd /var/opt/mps/serverroot/ds6/bin # echo replmanager > pwd.txt

Verify that the file was successfully created.
# cat pwd.txt replmanager

Run dsconf set-server-prop to set the replication manager password using pwd.txt as input.

# ./dsconf set-server-prop -h ds2.sp-example.com -p 1489 
def-repl-manager-pwd-file:pwd.txt

Enter "cn=Directory Manager" password: dsmanager

Remove the pwd.txt file.

Log out of the ds2.sp-example.com host machine.

To Create Replication Agreements for Each User Data Instance

A replication agreement is a set of parameters on a supplier that controls how updates are sent to a given consumer. In this deployment, the agreement simply makes the user data instances aware of each other.

Run dsconf create-repl-agmt to create the replication agreement.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf create-repl-agmt -h ds1.sp-example.com 
 -p 1489 o=spusers.com ds2.sp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf init-repl-dest o=spusers.com ds1.sp-example.com:1489" 
to start replication of "o=spusers.com" data.

Run dsconf list-repl-agmts to verify that the replication agreement was successfully created.
# ./dsconf list-repl-agmts -p 1489 Enter "cn=Directory Manager" password: dsmanager o=spusers.com ds2.sp-example.com:1489
This response indicates that the Directory Server 1 base suffix will be replicated to Directory Server 2.

Log out of the ds1.sp-example.com host machine.

Run dsconf create-repl-agmt to create the replication agreement.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf create-repl-agmt -h ds2.sp-example.com -p 1489 
o=spusers.com ds1.sp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf init-repl-dest o=spusers.com ds1.sp-example.com:1489" 
to start replication of "o=spusers.com" data.

Run dsconf list-repl-agmts to verify that the replication agreement was successfully created.
# ./dsconf list-repl-agmts -p 1489 Enter "cn=Directory Manager" password: dsmanager o=spusers.com ds1.sp-example.com:1489
This response indicates that the Directory Server 2 base suffix will be replicated to Directory Server 1.

Log out of the ds2.sp-example.com host machine.

To Initialize the Replication Agreements

Use this procedure to initialize the user data instance on Directory Server 1. The previously created agreements will replicate the data to Directory Server 2.

Note –

Initialization is not required on both instances when configuring for MMR.

Run dsconf show-repl-agmt-status to verify that the replication agreements have not yet been initialized.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf show-repl-agmt-status -h ds1.sp-example.com 
 -p 1489 o=spusers.com ds2.sp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Configuration Status 		: OK
Authentication Status		: OK
Initialization Status		: NOT OK

Status:						: Dest. Not Initialized

Run dsconf init-repl-dest to initialize the replication agreements.

# ./dsconf init-repl-dest -h ds1.sp-example.com 
 -p 1489 o=spusers.com ds2.sp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Started initialization of "ds2.sp-example.com:1489"; Sep 13, 2008 9:58:08 AM
Sent 2 entries.
Completed initialization of "ds2.sp-example.com:1489"; Sep 13, 2008 9:58:12 AM

Run dsconf show-repl-agmt-status again to verify that the replication agreements are now initialized.

# ./dsconf show-repl-agmt-status -h ds1.sp-example.com 
 -p 1489 o=spusers.com ds2.sp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Configuration Status 		: OK
Authentication Status		: OK
Initialization Status		: OK

Status:						: Enabled
Last Update Date				:  Sep 13, 2008 9:58:17 AM

To Verify Successful User Data Replication

Before You Begin

This procedure assumes you have just completed To Initialize the Replication Agreements and are still logged into the ds2.sp-example.com host machine as a root user.

Prepare an LDIF file with the following contents and save it in the /tmp directory as people.ldif.

dn: ou=People,o=spusers.com
objectclass: top
objectclass: organizationalUnit
ou: People
description: Container for user entries

Run ldapmodify on the ds1.sp-example.com host machine using people.ldif as input.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapmodify -a -h ds1.sp-example.com -p 1489 
-f /tmp/people.ldif -D cn=Directory Manager,cn=Administrators,cn=config 
-w dsmanager

adding new entry ou=People,o=spusers.com

After the entry is created, log in to the ds2.sp-example.com host machine as a root user.

Run ldapsearch on Directory Server 2 to verify that ou=People was successfully replicated.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -b "o=spusers.com" -p 1489 
-D "cn=Directory Manager" -w dsmanager 
"objectclass=organizationalUnit"

version: 1
dn: ou=People,o=spusers.com
objectClass: top
objectClass: organizationalUnit
ou: People
description Container for user entries

Now run ldapdelete on Directory Server 2 to delete ou=People.

# ./ldapdelete -h ds2.sp-example.com -p 1489 
 -D "cn=Directory Manager" -w dsmanager 
"ou=People,o=spusers.com"

Now, as a root user on Directory Server 1, run ldapsearch to verify that the deletion was replicated.
# ./ldapsearch -b "o=spusers.com" -p 1489 -D "cn=Directory Manager" -w dsmanager "objectclass=organizationalUnit"
The search will return no results as the delete was successfully replicated.

Log out of both Directory Server host machines.

7.3 Modifying the Directory Server Schema

This deployment will be used to test SAML v2 communications. Towards this end, modify the LDAP schema used by the Directory Server user data instances on the service provider side to recognize and store SAML v2 attributes.

To Modify the Directory Server LDAP Schema for SAML v2 User Data

Create an LDIF file with the following information and save it as /tmp/saml.ldif.

This file includes SAML v2 LDAP attributes.

dn: CN=schema
changetype:modify
add:attributeTypes
attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.500 
NAME 'sun-fm-saml2-nameid-infokey' 
DESC 'SAML 2.0 Name Identifier Information Key' 
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
'Sun Java System Access Management' )

attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.501 
NAME 'sun-fm-saml2-nameid-info' 
DESC 'SAML 2.0 Name Identifier Information' 
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
'Sun Java System Access Management' )
-
add:objectClasses
objectClasses: ( 1.3.6.1.4.1.42.2.27.9.2.200 
NAME 'sunFMSAML2NameIdentifier' 
DESC 'SAML 2.0 name identifier objectclass' 
SUP top AUXILIARY MAY 
( sun-fm-saml2-nameid-infokey $ sun-fm-saml2-nameid-info ) 
X-ORIGIN 'Sun Java System Access Management' )

Run ldapmodify on the ds1.sp-example.com host machine using /tmp/saml.ldif as input.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ldapmodify -a -h ds2.sp-example.com -p 1489 
-D "cn=Directory Manager" -w dsmanager -f /tmp/saml.ldif

modifying entry CN=schema

Log out of the ds1.idp-example.com host machine.

7.4 Enabling Secure Communication for the Directory Server User Data Instances

By default, when an instance of Directory Server is created (in this case, sp-users), its SSL port is secured with a self-signed certificate named defaultCert. A self-signed certificate contains a public and private key; the public key is signed by the private key. The sp-users instances, though, need to use a server certificate signed by a certificate authority (CA) to allow for secure communication between the instances and the soon-to-be-installed user data load balancer. This entails installing the server certificate signed by the CA and the root certificate confirming the signature of the CA on both Directory Server host machines. Use the following list of procedures as a checklist for completing this task.

To Install a Root Certificate and a Server Certificate on Directory Server 1

Before You Begin

You should already have a root certificate from the CA of your choice. Send server certificate requests to the same CA. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Generate a request for a server certificate signed by a CA.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm request-cert -S "CN=ds1.sp-example.com, 
OU=OpenSSO Enterprise, O=Sun Microsystems, L=Santa Clara 
 ST=California, C=US" -F ascii -o ds-1.csr /var/opt/mps/sp-users

ds-1.csr is the certificate request.

Send ds-1.csr to the CA of your choice.

The CA issues and returns a certified server certificate named ds-1.cer.

Add ds-1.cer, the CA-signed server certificate, to the certificate store.
# ./dsadm add-cert /var/opt/mps/sp-users server-cert ds-1.cer

Add ca.cer, the CA root certificate, to the certificate store.

# ./dsadm add-cert --ca /var/opt/mps/sp-users opensslCA ca.cer

(Optional) Verify that the CA root certificate was successfully added.

# ./dsadm list-certs -C /var/opt/mps/sp-users | grep opensslCA

opensslCA
2008/02/06 00:00  2017/02/06 00:00  n  
CN=Certificate Manager,OU=opensso,O=Identity,C=US
Same as issuer

Configure the Directory Server instance to use the imported certificates.

# ./dsconf set-server-prop -h ds1.sp-example.com 
-p 1489 ssl-rsa-cert-name:server-cert

Enter "cn=Directory Manager" password: dsmanager

Before setting SSL configuration, export Directory Server data.

Do you want to continue [y/n] ?  y

Directory Server must be restarted for changes to take effect.

Restart the Directory Server instance.

Directory Server needs to be restarted to use the new certificates.

# ./dsadm stop /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' stopped

# ./dsadm start /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' started: pid=11591

Run ldapsearch on Directory Server 1 to verify that the directory entries can be accessed through the secure port.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds1.sp-example.com -p 1736 
-Z -P /var/opt/mps/sp-users/alias/slapd-cert8.db 
-b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass:top
namingContexts: o=spusers.com
supportedExtension: 2.16.840.1.113730.3.5.7
:
supportedSSLCiphers: SSL-CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL-CK_RC2_128_CBC_EXPORT40_WITH_MD5

This confirms that the Directory Server instance can be accessed through the secure port.

Log out of the ds1.sp-example.com host machine.

To Install a Root Certificate and a Server Certificate on Directory Server 2

Before You Begin

You should already have a root certificate from the CA of your choice. Send any server certificate requests to the same CA. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Generate a request for a server certificate signed by a CA.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm request-cert -S "CN=ds2.sp-example.com, 
OU=OpenSSO Enterprise, O=Sun Microsystems, L=Santa Clara 
 ST=California, C=US" -F ascii -o ds-2.csr /var/opt/mps/sp-users

ds-2.csr is the certificate request.

Send ds-2.csr to the CA of your choice.

The CA issues and returns a certified server certificate named ds-2.cer.

Add ds-2.cer, the CA-signed server certificate, to the certificate store.
# ./dsadm add-cert /var/opt/mps/sp-users server-cert ds-2.cer

Add ca.cer, the CA root certificate, to the certificate store.

# ./dsadm add-cert --ca /var/opt/mps/sp-users opensslCA ca.cer

(Optional) Verify that the CA root certificate was successfully added.

# ./dsadm list-certs -C /var/opt/mps/sp-users | grep opensslCA

opensslCA
2008/02/06 00:00  2017/02/06 00:00  n  
CN=Certificate Manager,OU=opensso,O=Identity,C=us  
Same as issuer

Configure the Directory Server instance to use the imported certificates.

# ./dsconf set-server-prop -h ds2.sp-example.com 
-p 1489 ssl-rsa-cert-name:server-cert

Enter "cn=Directory Manager" password: dsmanager

Before setting SSL configuration, export Directory Server data.

Do you want to continue [y/n] ?  y

Directory Server must be restarted for changes to take effect.

Restart the Directory Server instance.

Directory Server needs to be restarted to use the new certificates.

# ./dsadm stop /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' stopped

# ./dsadm start /var/opt/mps/sp-users

Directory Server instance '/var/opt/mps/sp-users' started: pid=7311

Run ldapsearch on Directory Server 2 to verify that the directory entries can be accessed through the secure port.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.sp-example.com -p 1736 
-Z -P /var/opt/mps/sp-users/alias/slapd-cert8.db 
-b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass:top
namingContexts: o=spusers.com
supportedExtension: 2.16.840.1.113730.3.5.7
:
supportedSSLCiphers: SSL-CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL-CK_RC2_128_CBC_EXPORT40_WITH_MD5

This confirms that the Directory Server instance can be accessed through the secure port.

Log out of the ds2.sp-example.com host machine.

7.5 Configuring the Directory Server Load Balancer

Load Balancer 1 (lb1.sp-example.com) is configured in front of the Directory Server user data instances on the service provider side. This section assumes that you have already installed the load balancer. Before beginning, note the following:

The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
Know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
Get the IP addresses for Directory Server 1 and Directory Server 2 by running the following command on each host machine:
# ifconfig -a

Use the following list of procedures as a checklist for completing the task.

To Import the Root Certificate to the User Data Load Balancer

Install the CA root certificate on the user data load balancer to ensure that a link between the load balancer can be maintained with the CA. Use the same root certificate that you imported in 7.4 Enabling Secure Communication for the Directory Server User Data Instances. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Access https://is-f5.siroe.com, the BIG-IP load balancer login page, in a web browser.

Click Proxies.

Click the Cert-Admin tab.

Click Import.

In the Import Type field, choose Certificate and click Continue.

Click Browse in the Certificate File field on the Install SSL Certificate page.

Choose Browser in the Choose File dialog box.

Navigate to ca.cer and click Open.

Enter opensslCA in the Certificate Identifier field.

Click Install Certificate.

The Certificate opensslCA page is displayed.

Click Return to Certificate Administration on the Certificate opensslCA page.

opensslCA, the root certificate, is now included in the Certificate ID list.

To Configure Directory Server Load Balancer 1

Before You Begin

This procedure assumes that you have just completed To Import the Root Certificate to the User Data Load Balancer and are still logged into the load balancer console.

Click Configure your BIG-IP (R) using the Configuration Utility.

Create a Pool.

A pool contains all the backend server instances.
1. In the left pane, click Pools.
2. On the Pools tab, click Add.
3. In the Add Pool dialog, provide the following information:
  
  Pool Name
  
  DirectoryServerSP-UserData-Pool
  
  Load Balancing Method
  
  Round Robin
  
  Resources
  
  Add the IP address and port number of both Directory Server host machines.
  
  Note –
  Use port number 1489.
4. Click Done.

Add a Virtual Server.

The virtual server presents an address to the outside world and, when users attempt to connect, it would forward the connection to the most appropriate real server.

Tip –
If you encounter JavaScript^TM errors or otherwise cannot proceed to create a virtual server, try using Internet Explorer.
1. In the left frame, click Virtual Servers.
2. Click Add on the Virtual Servers tab.
3. In the Add a Virtual Server dialog box, provide the following information:
  
  Address
  
  Enter the IP address for lb1.sp-example.com
  
  Service
  
  489
4. Continue to click Next until you reach the Pool Selection dialog box.
5. Assign DirectoryServerSP-UserData-Pool to the virtual server in the Pool Selection dialog box.
6. Click Done.

Add Monitors

Monitors are required for the load balancer to detect the backend server failures.
1. In the left frame, click Monitors.
2. Click the Basic Associations tab.
3. Add an LDAP monitor for the Directory Server 1 node.
  
  In the Node column, locate the IP address and port number previously entered for Directory Server 1 and select the Add checkbox.
4. Add an LDAP monitor for the Directory Server 2 node.
  
  In the Node column, locate the IP address and port number previously entered for Directory Server 2 and select the Add checkbox.
5. At the top of the Node column, in the drop-down list, choose ldap-tcp.
6. Click Apply.

Configure the load balancer for simple persistence.

With simple persistence, all requests sent within a specified interval are processed by the same Directory Server instance, ensuring complete replication of entries. For example, when a request requires information to be written to Directory Server 1, that information must also be replicated to Directory Server 2. As the replication takes time to complete, if a related request is directed by the load balancer to Directory Server 2 during the replication process itself, the request may fail as the entry might only be partially created. When properly configured, simple persistence ensures that both requests are routed to Directory Server 1 and processed in consecutive order; the first request is finished before the second request begins processing. Simple persistence ensures that within the specified interval, no errors or delays occur due to replication time or redirects when retrieving data. Simple persistence tracks connections based only on the client IP address.
1. In the left frame, click Pools.
2. Click the name of the pool you want to configure.
  
  In this example, DirectoryServerSP-UserData-Pool.
3. Click the Persistence tab.
4. Under Persistence Type, select Simple.
5. Enter 300 seconds for the Timeout interval.
6. Click Apply.

Verify the Directory Server load balancer configuration using the following sub-procedure.

On each host machine, use the tail command to monitor the Directory Server access log.

# cd /var/opt/mps/sp-users/logs
# tail -f access

You should see connections to the load balancer IP address opening and closing. For example:

[12/July/2008:13:10:20-0700] conn=69755 op=-1 msgId=-1 - closed 
[12/July/2008:13:10:25-0700] conn=69756 op=-1 msgId=-1 
- fd=27 slot=27 LDAP connection from IP_address to IP_address
[12/July/2008:13:10:25-0700] conn=69756 op=0 msgId=0 
- RESULT err=80 tag=120 nentries=0 etime=0 
[12/July/2008:13:10:25-0700] conn=69756 op=-1 msgId=-1 
- closing from IP_address

Execute the following LDAP search against the Directory Server load balancer from Directory Server 1.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h lb1.sp-example.com -p 489 -Z 
-P /var/opt/mps/sp-users/alias/slapd-cert8.db
-b "o=spusers.com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: o=spusers.com
objectClass: top
objectClass: organization
o: spusers.com

Make sure the returned entries display in the access log on only one Directory Server host machine.

Run dsadm stop to stop Directory Server 1.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm stop /var/opt/mps/sp-users

Perform the (same) LDAP search against the Directory Server load balancer from Directory Server 2.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h lb1.sp-example.com -p 489 -Z 
-P /var/opt/mps/sp-users/alias/slapd-cert8.db
-b "o=spusers.com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: o=spusers.com
objectClass: top
objectClass: organization
o: spusers.com

Make sure the returned entries display in the access log on only Directory Server 2.

Note –

You may encounter the following error message:

ldap_simple_bind: Cant' connect to the LDAP 
server — Connection refused

This means that the load balancer may not fully detect that Directory Server 1 is stopped. In this case, you may have started the search too soon based on the polling interval setting. For example, if the polling interval is set to 10 seconds, you should wait ten seconds to start the search. You can reset the timeout properties to a lower value using the load balancer console.

Click the Monitors tab.
Click the ldap-tcp monitor name.
In the Interval field, set the value to 5.

This tells the load balancer to poll the server every 5 seconds.
In the Timeout field, set the value to 16.
Click Apply and repeat the LDAP search.

See your load balancer documentation for more information on the timeout property.

Start Directory Server 1.
# ./dsadm start /var/opt/mps/sp-users

Stop Directory Server 2.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm stop /var/opt/mps/sp-users

Perform the (same) LDAP search against the Directory Server load balancer from Directory Server 1 to confirm that the request is forwarded to the running Directory Server 1.

# cd /var/opt/mps/serverroot/dsrk6/bin
 ./ldapsearch -h lb1.sp-example.com -p 489 -Z 
-P /var/opt/mps/am-users/alias/slapd-cert8.db
-b "o=spusers.com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: o=spusers.com
objectClass: top
objectClass: organization
o: spusers.com

Make sure the returned entries display in the access log on only Directory Server 1.

Start Directory Server 2.
# ./dsadm start /var/opt/mps/sp-users

Log out of both Directory Server host machines and the load balancer console.

7.6 Creating a Test User

Create a user entry in the replicated Directory Server user data instances for spuser.

Note –

If you are using an existing user data store, create the appropriate users in it and move on to Chapter 9, Configuring OpenSSO Enterprise Realms for User Authentication.

To Import Test User Data into the Replicated Directory Server Instances

Create an LDIF file for the test user and import the file into ds1.sp-example.com. The test user data will then be replicated to ds2.sp-example.com.

Create an LDIF file with the following entries.

dn: ou=users,o=spusers.com
objectclass: top
objectclass: organizationalUnit
ou: users
description: Container for user entries

dn: ou=Groups,o=spusers.com
objectClass: top
objectClass: organizationalUnit
ou: Groups
description: Container for group entries

dn: uid=spuser,ou=users,o=spusers.com
uid: spuser
givenName: sp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: sp user
userPassword: spuser
inetUserStatus: Active

Save the file as sp-users.ldif in the /tmp directory.

Import the LDIF file into Directory Server 1 using ldapmodify.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapmodify -h ds1.sp-example.com -p 1489 
 -D "cn=Directory Manager" -w dsmanager 
 -a -f /tmp/sp-users.ldif

adding new entry ou=users,o=spusers.com

adding new entry ou=Groups,o=spusers.com

adding new entry uid=spuser,ou=users,o=spusers.com

Verify that the new users were imported using ldapsearch.

# ./ldapsearch -h ds1.sp-example.com
 -b "o=spusers.com" -p 1489 -D "cn=Directory Manager"
 -w dsmanager "uid=spuser"

version: 1
dn: uid=spuser,ou=users,o=spusers.com
uid: spuser
givenName: sp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: sp user
userPassword: 
 {SSHA}H5LpB+QLZMoL9SiXzY/DokHKXRclELVy7w25AA==
inetUserStatus: Active

Log out of the ds1.sp-example.com host machine.

(Optional) Verify that the entries were replicated to Directory Server 2 by logging in as a root user to the ds2.idp-example.com host machine and using ldapsearch.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.sp-example.com
 -b "o=spusers.com" -p 1489 -D "cn=Directory Manager"
 -w dsmanager ""

version: 1
dn: o=spusers.com
objectClass: top
objectClass: domain
dc: company

dn: ou=users,o=spusers.com
objectClass: top
objectClass: organizationalUnit
ou: users
description: Container for user entries

dn: ou=Groups,o=spusers.com
objectClass: top
objectClass: organizationalUnit
ou: Groups
description: Container for group entries

dn: uid=spuser,ou=users,o=spusers.com
uid: spuser
givenName: sp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: sp user
userPassword: 
 {SSHA}H5LpB+QLZMoL9SiXzY/DokHKXRclELVy7w25AA==
inetUserStatus: Active

Log out of the ds2.sp-example.com host machine.